Huntress Details Threats and Attacks Targeting Schools
Summary
Huntress reports education accounted for 21% of incidents it observed in 2024, including attacks involving exposed RDP, compromised RMM tools and attempted data theft. It recommends MFA, patching, tested backups and monitoring.
Key points
- Huntress’s 2025 Cyber Threat Report says education represented 21% of incidents it observed in 2024.
- Malicious scripts accounted for 24% of education-sector threats, infostealers 16%, malware 13% and ransomware 7%; Chromeloader represented nearly 70% of observed infostealer infections.
- In one school-district case, attackers brute-forced exposed RDP. Huntress found the host exposed 10 ports publicly, isolated the server and blocked the malicious IP.
- In a separate incident, attackers used an MSP’s compromised Atera RMM instance to install AnyDesk and add a local administrator account. Huntress says the account and software were removed and Atera credentials rotated.
- Huntress says an RDP brute-force incident at a high school led to attempted RClone data exfiltration; mass isolation stopped the activity before it escalated.
- The article recommends MFA, patching known exploited vulnerabilities, tested backups, security-awareness training and endpoint monitoring.
Article Details
- Event Type
- Threat activity targeting the education sector, including RDP brute-force access, abuse of an MSP's Atera RMM instance, and attempted data exfiltration using RClone.
- Impact
- Huntress reported that education accounted for 21% of incidents it observed in 2024. Reported incidents included exposure of sensitive student and educator information, disruption to school operations, and attempted theft of school data. In the described cases, Huntress blocked the malicious IP and isolated a server in one incident, helped remove a malicious AnyDesk instance and unauthorized account in another, and stopped an exfiltration attempt through mass isolation.
MITRE ATT&CK
T1021 · Remote ServicesThe article reports an actor moving laterally from a host during an incident involving RDP brute force.T1021.001 · Remote Desktop ProtocolThe article describes threat actors gaining access through exposed Remote Desktop Protocol (RDP).T1098 · Account ManipulationA threat actor added the WDAGUtilltyAccount user to the local Administrators group.T1110 · Brute ForceThe article describes an exposed RDP instance being brute-forced to gain access to a school district's network.T1219 · Remote Access ToolsThreat actors abused Atera and installed AnyDesk for remote access to a host.T1567 · Exfiltration Over Web ServiceRClone was used in an attempt to exfiltrate data from a high school.
People
Malware
ChromeloaderOut of the infostealer infections seen, Chromeloader was the most prevalent, accounting for almost 70% of incidents.MedusaFor instance, after the Minneapolis Public Schools were hit by Medusa ransomware in 2023, the threat actors behind the attack released highly sensitive details about students, including sexual assault case files.
Vendors
Products
AnyDeskIn this incident, a user operating as SYSTEM used the Atera instance to execute C:\ProgramData\AnyDesk.exe and then install an additional AnyDesk RMM onto the host.AteraIn May, threat actors compromised an Atera RMM instance used by a managed service provider (MSP) and used that access to hit several of their customers, including a school district.Managed EDRmalicious authentication via an exposed RDP instance for this school, which used both Managed SIEM and Managed EDR.Managed SIEMable to find the malicious authentication via an exposed RDP instance for this school, which used both Managed SIEM and Managed EDR.